Forum Discussion
Specify which Entra ID Sign-in logs are sent to Log Analytics Workspace
Hi, as the title says I am curious if its possible if I can limit which login logs are sent to a Log Analytics Workspace. We currently have a couple of service accounts in use that generate a high amount of traffic (an issue being worked on separately) and would like to exclude the logs from these specific users from being sent to LAW.
Hi, no, currently you cannot directly filter which EntraID sign-in logs are sent to log analytics workspace (LAW). All configured sign-in logs are forwarded without user- or group-level granularity.
The only workaround is to filter the data using kql once the logs are already in LAW. If you want to reduce costs or noise in reports, you can set up queries to exclude service accounts from alerts or dashboards.
1 Reply
Hi, no, currently you cannot directly filter which EntraID sign-in logs are sent to log analytics workspace (LAW). All configured sign-in logs are forwarded without user- or group-level granularity.
The only workaround is to filter the data using kql once the logs are already in LAW. If you want to reduce costs or noise in reports, you can set up queries to exclude service accounts from alerts or dashboards.